How to search with variables from lookup csv?

[fishmong3r]

Let's say I have a search and a very basic lookup table (csv). What I want to achieve is to use the values in the table for my search.

So my table.csv:

id	name
1	first
2	second
3	third

Now, I want to simply run a query like which returns every single log that has any of the id's from my lookup table.

index=myIndex sourcetype=mySourcetype id IN somelookup ---- where id is in table.csv's id column.

The second challenge then would be to actually have the name column values added as a field to the results for clarity.

[ITWhisperer · Accepted solution]

Try something like this

index=myIndex sourcetype=mySourcetype [ | inputlookup table.csv | fields id ]
| lookup table.csv

[fishmong3r]

For that, I get "Error in 'lookup' command: Must specify one or more lookup fields."

[ITWhisperer]

| lookup table.csv id

[fishmong3r]

lovely!